PRiVACY PoLICY

Your account. When you sign in with X or a wallet (through Privy), we receive your X handle and profile picture, your Privy account ID and the wallet address you signed in with.

Your profile. Username, display name, bio, avatar, background, links, widgets and their settings, badges you choose to show, and the invite code or referral link you joined with.

Wallets you link. Linking a wallet only asks for a signature on a message (no transaction, no access to funds). We keep the address so wallet widgets can add up their value and to check how many FL3X tokens you hold for your tier.

Images you upload. PNG, JPG or WebP files are re-encoded to WebP on our servers, which removes metadata such as location (EXIF), then stored with your account.

Connected accounts. If you connect Spotify, we store access tokens, encrypted, and only use them to read the track you are playing or played last. We never read your playlists, library or listening history beyond that.

Waitlist. Your X handle, the username you would like and the referral you came from.

Visits to profiles. See Profile analytics.

Your profile at fl3x.lol/@username is public: name, bio, pictures, links, widgets and what they show (for example a P&L, a portfolio value, the track you play), your badges and your view count. Search engines may index it.

Wallet addresses are never shown on your profile. Visitors see the values your widgets display, not the addresses behind them. Keep in mind that blockchains are public: anyone who already knows an address can look it up elsewhere.

When someone opens a profile or clicks one of its links, we record an event so the owner can see their analytics. Each event holds:

• the country, read from our host's network headers (no precise location);
• the type of device (desktop, mobile or other), from the browser's user agent;
• the website that sent the visitor, as a domain name only (for example x.com), never the full address;
• for clicks, which link was clicked (for example "Discord");
• a visitor hash: a one-way fingerprint of the IP address and user agent, mixed with a secret that changes every day.

IP addresses are never stored. The hash cannot be turned back into an IP, and because the secret changes daily, the same visitor cannot be followed from one day to the next. It is only used to count unique visitors and to count at most one view per visitor per day. Bots and link previews are ignored.

• to run your profile and the dashboard, and keep your widgets up to date;
• to work out your tier from the tokens held in your wallets, and to award badges;
• to manage invites, referrals and the waitlist;
• to show you your analytics;
• to keep FL3X safe: rate limits, abuse and fraud prevention, fixing bugs.

FL3X uses no advertising or tracking cookies and no third-party analytics. What we keep in your browser is only what the site needs:

• Privy's session storage and cookies, to keep you signed in;
• your invite code and chosen username while you sign in with X (local storage, cleared once you join);
• a per-tab marker so a profile view is counted once (session storage, gone when you close the tab).

Because these are strictly necessary, there is no consent banner.

We never sell or rent personal data. We use these providers to run FL3X, each only for its part:

• Privy: sign-in with X and wallets.
• Vercel: hosts the website and tells us the visitor's country.
• Render: hosts our API and database.
• Blockchain data providers (Solana RPC providers, Jupiter, Moralis, DefiLlama, public EVM nodes, DexScreener): receive wallet or token addresses to return balances and prices. They never receive your name or account.
• Spotify (if you connect it), Twitch and YouTube (public channel data for video widgets; Twitch may go through decapi.me), Discord and Telegram (public invite and member counts).
• Error monitoring (Sentry, if enabled): technical error reports, without passwords or tokens.

Some of these companies are based in the United States, so data may be processed outside your country. They are bound by their own privacy terms and, where required, standard contractual clauses. We may also share data when the law requires it.

Music and video widgets show content from Spotify, Twitch and YouTube, with their names and artwork. That content belongs to them and their creators, and their own terms and privacy policies apply when you open it.

You can disconnect Spotify at any time in Settings, which deletes the tokens we hold. You can also remove FL3X from your Spotify account's apps page. If Spotify reports that access was revoked, we delete the connection automatically.

• account, profile, wallets and images: while your account exists;
• profile analytics: while the profile exists, deleted with it;
• cached public data (prices, channel info): a few minutes to a day;
• waitlist entries: until you join or ask us to remove them;
• our hosts' technical logs: a few weeks, for security.

You can edit your profile at any time from the dashboard. You can also ask us to access, correct, export or delete your data, or object to how we use it. Write to support@fl3x.lol from the X account or with a signature from a wallet linked to your profile, so we can check it is you. We answer within 30 days. Deleting your account removes your profile, wallets, images, connections and analytics.

If you are in the EU or the UK, you can also complain to your data protection authority.

Connections are encrypted (HTTPS), third-party tokens are encrypted at rest, we never ask for or store private keys or seed phrases, and wallet linking only ever asks for a signature on a readable message. No system is perfect: if something goes wrong that affects your data, we will tell you.

FL3X is for people aged 18 and over. We do not knowingly collect data from anyone younger.

We will update this page when FL3X changes and change the date at the top. For important changes we will also let members know. Questions: support@fl3x.lol.